Release Cartographer

An autonomous GitLab workflow that takes a software change from issue to tested, secured, monitored release with human approval only at the final gate.

Comment

Inspiration

Code generation is largely solved, but shipping code safely is not. Once an MR exists, teams still manually stitch together review, testing, container builds, security scans, release approvals, monitoring, and governance. That post-code path is fragmented, slow, and error-prone. We wanted to show that the entire journey, from a work item to an audited production release, can be automated and made observable, with humans approving only the irreversible final gate.

What it does

Release Cartographer is a GitLab-native DevSecOps control plane that maps a single release across all nine lifecycle stages:

Plan -> Create -> Verify -> Package -> Secure -> Release -> Configure -> Monitor -> Govern

  • FastAPI service ingests structured lifecycle events per release ID and computes a deterministic readiness summary (ready / in_progress / attention).
  • Interactive 9-stage dashboard renders stage badges, completion progress, and a live telemetry simulator.
  • MCP server lets AI agents (GitLab Duo, Claude, IDE assistants) query status, record events, list failures, and formulate governance verdicts over JSON-RPC 2.0.
  • 9-stage GitLab CI pipeline emits one event artifact per stage and dynamically compiles lifecycle-report.json, a machine-readable governance decision record.
  • GitLab Duo agents drive planning, implementation, review, self-healing, and governance.
  • Service deployed serverless on Google Cloud Run with scale-to-zero.

How we built it

  1. App and API: FastAPI with Pydantic models, versioned health, events, lifecycle, dashboard, docs, redoc, schema download, and mcp.
  2. Telemetry model: frozen LifecycleEvent dataclass and summarize_events aggregator produce deterministic stage state and overall verdict.
  3. Dashboard: server-rendered HTML with SVG icons, responsive layout, automatic light/dark theme detection.
  4. MCP layer: JSON-RPC 2.0 handler exposing four tools with strict input schemas.
  5. CI/CD: .gitlab-ci.yml defines all nine stages; each job writes an event JSON artifact; govern stage runs scripts/build_lifecycle_report.py.
  6. Agents: Duo Developer Flow authored health-metadata feature (Work Item #2, Session 9972220); Duo Code/Security Review validated MR; Duo CI Expert self-healed intentional test failure (commit 4d5a06c).
  7. Deployment: Docker image built in CI and deployed to Google Cloud Run.

Challenges we ran into

  • Keeping telemetry deterministic across in-memory state and CI artifacts.
  • Designing MCP tool schemas strict enough for agents but flexible for human simulation.
  • Demonstrating genuine autonomous self-healing rather than scripted success.
  • Balancing rich dashboard with sub-50MB container and scale-to-zero footprint.

Accomplishments that we're proud of

  • All nine DevSecOps stages genuinely touched.
  • Real Duo-authored commit and Duo-remediated commit exist in pipeline history.
  • Deterministic lifecycle-report.json certifying 9/9 stages ready.
  • Live public Cloud Run deployment with interactive dashboard and MCP endpoint.
  • Full test suite (12 tests) and clean Ruff lint.

What we learned

  • Deterministic telemetry is the foundation of trustworthy automation. Computing one readiness verdict from explicit stage events makes failures inspectable instead of hidden.
  • Strict MCP input schemas let agents act safely while still allowing humans to simulate events during demos.
  • Autonomous self-healing is credible only when the failing test encodes the intended behavior and the agent makes the smallest possible correction.
  • A supervised autonomy model works well for release engineering: automate every reversible step and require human approval only at the final governance gate.
  • Sustainability and usability can improve together. Scale-to-zero, slim images, and short pipelines reduce idle energy without removing dashboard features.

What's next for Release Cartographer

  • Persist telemetry in a database instead of in-memory.
  • Add GitLab webhook ingestion so pipeline events flow automatically.
  • Expand MCP tools (rollback, promote, diff) and add stdio transport.
  • Add policy-as-code gates and SBOM attestation to secure stage.

Built With

Share this project:

Updates

Submission history